b64b1ff248e7b10e8b0a4b55cd60bb46cb2ed773cb44e9396116b7761e31dfde

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91f8a82e1f62b2e95137ba5f3dc5dcba_JaffaCakes118.pdf
Size

92KB
MD5

91f8a82e1f62b2e95137ba5f3dc5dcba
SHA1

208ebc1aa3ab077e28c3079dc53486016ba3044d
SHA256

b64b1ff248e7b10e8b0a4b55cd60bb46cb2ed773cb44e9396116b7761e31dfde
SHA512

be06f4909f85701110bb08aa48e9cd167b53a725a330211c543b116820ab79211a0c437f312955448c8c965f90a059d6c267b0967cdb66a833aafcf51a51b4bc
SSDEEP

1536:CB0ZrSxtm8U8C6KBDUc81yh5FnUD+b0VpwznrfVOmosZjg2s:U0ZG7mNLBDUc81yh5K+b0VebrdOmosZ4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

AcroRd32.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid	Process
1852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid	Process
1852	AcroRd32.exe
1852	AcroRd32.exe
1852	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91f8a82e1f62b2e95137ba5f3dc5dcba_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9cd9b629959a36468ac11daf2e4a2bce

SHA1
3f3dbddf609f4a54d49772603efcf21cdccab7bd

SHA256
a5314acb2450e520bbb44ee2808e1b510b58d92b56562ed4e81b52acb8789a38

SHA512
c52f5ff500481af1b2a5eaea469a24d3093be89d13c52112c726d0d717dfb5f592152b79fe5c623dc1e689308451c44a1a9b8906f89876cfe1ea7ea4a9d08fb6

Download Submit